diff options
author | Peter Hurley <peter@hurleysoftware.com> | 2013-03-08 15:43:27 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-03-08 18:05:33 -0500 |
commit | 88b9e456b1649722673ffa147914299799dc9041 (patch) | |
tree | cb2c12ee6fc4ad53e1a15c4e19f676b1d0058183 | |
parent | e1082f45f1e2bbf6e25f6b614fc6616ebf709d19 (diff) |
ipc: don't allocate a copy larger than max
When MSG_COPY is set, a duplicate message must be allocated for the copy
before locking the queue. However, the copy could not be larger than was
sent which is limited to msg_ctlmax.
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Stanislav Kinsbursky <skinsbursky@parallels.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r-- | ipc/msg.c | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -820,15 +820,17 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, | |||
820 | struct msg_msg *copy = NULL; | 820 | struct msg_msg *copy = NULL; |
821 | unsigned long copy_number = 0; | 821 | unsigned long copy_number = 0; |
822 | 822 | ||
823 | ns = current->nsproxy->ipc_ns; | ||
824 | |||
823 | if (msqid < 0 || (long) bufsz < 0) | 825 | if (msqid < 0 || (long) bufsz < 0) |
824 | return -EINVAL; | 826 | return -EINVAL; |
825 | if (msgflg & MSG_COPY) { | 827 | if (msgflg & MSG_COPY) { |
826 | copy = prepare_copy(buf, bufsz, msgflg, &msgtyp, ©_number); | 828 | copy = prepare_copy(buf, min_t(size_t, bufsz, ns->msg_ctlmax), |
829 | msgflg, &msgtyp, ©_number); | ||
827 | if (IS_ERR(copy)) | 830 | if (IS_ERR(copy)) |
828 | return PTR_ERR(copy); | 831 | return PTR_ERR(copy); |
829 | } | 832 | } |
830 | mode = convert_mode(&msgtyp, msgflg); | 833 | mode = convert_mode(&msgtyp, msgflg); |
831 | ns = current->nsproxy->ipc_ns; | ||
832 | 834 | ||
833 | msq = msg_lock_check(ns, msqid); | 835 | msq = msg_lock_check(ns, msqid); |
834 | if (IS_ERR(msq)) { | 836 | if (IS_ERR(msq)) { |